CVE-2026-124695

In Progress Kendo UI for jQuery Form, the items.hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise...

CVE-2026-124018 Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with...

CVE-2026-124018

The Gutenverse Form plugin for WordPress (versions before 3.2.2 ) is vulnerable to a CSV formula injection flaw. The root cause is the use of sanitize_text_field() on the public form-submit REST route, which fails to strip formula-triggering characters such as =, +, @, or a leading minus. An unau...

EUVD-2026-124404

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with...

X-Recon

A utility for identifying web page inputs and conducting XSS scanning. Features: Subdomain Discovery: Retrieves relevant subdomains for the target website and consolidates them into a whitelist. These subdomains can be utilized during the scraping process. Site-wide Link Discovery: Collects all...

CVE-2026-118855 Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a...

CVE-2026-118855

Akaunting version 3.3.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability during invoice import. An authenticated user with invoice-creation permissions can import malicious HTML into an invoice status field. When another authenticated user opens the edit form for that invoice, t...

CSRFER

CSRFER / / | \ | | \ | / /\ --.| |/ / | | | | |/ / | | --. \ /| | | || / | /// / |\ | | | || |\ \ //| \| /| | -.--. " '-, ',' 2 \ \q \ . \ .--' '----. / . . \ .'.' \ .-.\ '-, ,/ .---;- . \ \ .\ // '-. \ \ | '. , '-. c=' Cooo -. '-. '. '-. \ snd '-. '. '-. \ ---' CSRFER is a tool to...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical unauthenticated remote code execution vulnerability in an open-source workflow automation platform. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Impact Exploitation Detection Remediation Mitigation Summary 🔎 Overview...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...

React2Shell

React2Shell – Advanced Discovery & Exploitation Framework An advanced React Server Components RSC vulnerability scanner and exploiter for CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications. This tool expands upon the original React2Shell research and proof-of-concept by introducing...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

CVE-2025-55182-Scanner

🛡️ CVE-2025-55182 Scanner React2Shell Developed by:SainiON Hacks A standalone GUI tool to detect and demonstrate the React Server Components Remote Code Execution RCE vulnerability CVE-2025-55182 in Next.js applications. 📺 Demo & Tutorial Watch the full breakdown and tool demonstration on my...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Reflected XSS in Login Form Email & Password Fields Vvveb CMS v1.0.7.2 Author: Andrew Paul Date of Discovery: August 12th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.7.2 and likely prior versions CVE ID: CVE-2025-9728 Summa...

CVE-2026-15201

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

Struts2Vuln

Vulnerable Struts2 application Requirements 1. Maven https://maven.apache.org 2. Struts = 2.5.10 CVE-2017-5638 - Apache Struts 2 Multipart form RCE Requirements 1. Locate a URL that issues a multipart form POST Getting Started 1. The application / server can be started with the following maven...

CVE-2026-15201

Synology DiskStation Manager (DSM) is vulnerable to an improper certificate validation flaw in the Support Form component. This vulnerability exists in versions prior to 7.3.2-86009-5 and 7.4.1-90080-1 . A man-in-the-middle (MITM) attacker can exploit this during support form submission to read a...

EUVD-2026-124192

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

CVE-2026-15201

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...